@tekmidian/pai 1.0.4 → 1.0.6

package/dist/hooks/supervision-banner.mjs

@@ -7351,7 +7351,7 @@ var require_public_api = __commonJS({
       }
       return doc;
     }
-    function parse2(src, reviver, options) {
+    function parse3(src, reviver, options) {
       let _reviver = void 0;
       if (typeof reviver === "function") {
         _reviver = reviver;
@@ -7392,7 +7392,7 @@ var require_public_api = __commonJS({
         return value.toString(options);
       return new Document5.Document(value, _replacer, options).toString(options);
     }
-    exports.parse = parse2;
+    exports.parse = parse3;
     exports.parseAllDocuments = parseAllDocuments;
     exports.parseDocument = parseDocument5;
     exports.stringify = stringify;
@@ -7777,27 +7777,6 @@ var init_scope = __esm({
   }
 });
 
-// src/workers/chatui.ts
-var init_chatui = __esm({
-  "src/workers/chatui.ts"() {
-    "use strict";
-  }
-});
-
-// src/workers/deadline.ts
-var init_deadline = __esm({
-  "src/workers/deadline.ts"() {
-    "use strict";
-  }
-});
-
-// src/workers/active-time.ts
-var init_active_time = __esm({
-  "src/workers/active-time.ts"() {
-    "use strict";
-  }
-});
-
 // src/workers/stagger.ts
 var init_stagger = __esm({
   "src/workers/stagger.ts"() {
@@ -7806,6 +7785,14 @@ var init_stagger = __esm({
   }
 });
 
+// src/workers/waiting.ts
+var init_waiting = __esm({
+  "src/workers/waiting.ts"() {
+    "use strict";
+    init_args();
+  }
+});
+
 // src/workers/capacity.ts
 var DEFAULT_CAPACITY;
 var init_capacity = __esm({
@@ -7813,23 +7800,37 @@ var init_capacity = __esm({
     "use strict";
     init_stagger();
     init_config3();
+    init_waiting();
     init_status();
     DEFAULT_CAPACITY = { enabled: true, localDefaultCap: 1, uncappedQueueCap: 3, maxTotalWaitMs: 2 * 36e5, heartbeatMs: 6e4, agingMs: 15 * 6e4 };
   }
 });
 
-// src/workers/denials.ts
-var init_denials = __esm({
-  "src/workers/denials.ts"() {
+// src/workers/chatui.ts
+var init_chatui = __esm({
+  "src/workers/chatui.ts"() {
     "use strict";
   }
 });
 
-// src/workers/waiting.ts
-var init_waiting = __esm({
-  "src/workers/waiting.ts"() {
+// src/workers/deadline.ts
+var init_deadline = __esm({
+  "src/workers/deadline.ts"() {
+    "use strict";
+  }
+});
+
+// src/workers/active-time.ts
+var init_active_time = __esm({
+  "src/workers/active-time.ts"() {
+    "use strict";
+  }
+});
+
+// src/workers/denials.ts
+var init_denials = __esm({
+  "src/workers/denials.ts"() {
     "use strict";
-    init_args();
   }
 });
 
@@ -8072,6 +8073,7 @@ var init_worktree = __esm({
     init_paths();
     init_pending();
     init_pool();
+    init_config2();
   }
 });
 
@@ -8095,6 +8097,156 @@ var init_endreason = __esm({
   }
 });
 
+// src/workers/ps-table.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+function truncateLines(text, max = PS_MAX_LINE) {
+  return text.split("\n").map((l) => l.length > max ? l.slice(0, max) : l).join("\n");
+}
+function psTable(format, run = realRunner, maxLine = PS_MAX_LINE) {
+  return truncateLines(run(["-axo", format]), maxLine);
+}
+var PS_MAX_BUFFER, PS_MAX_LINE, realRunner;
+var init_ps_table = __esm({
+  "src/workers/ps-table.ts"() {
+    "use strict";
+    PS_MAX_BUFFER = 64 * 1024 * 1024;
+    PS_MAX_LINE = 1024;
+    realRunner = (args) => execFileSync2("ps", args, { encoding: "utf8", env: { ...process.env, LC_ALL: "C" }, maxBuffer: PS_MAX_BUFFER, timeout: 15e3 });
+  }
+});
+
+// src/workers/hang-probe.ts
+var init_hang_probe = __esm({
+  "src/workers/hang-probe.ts"() {
+    "use strict";
+    init_ps_table();
+  }
+});
+
+// src/utils/redact.ts
+var REDACTED, REDACTED_RE, KEY_WORDS, VAL, REDACT_RULES, LINE_RULES, LONG_RUN, KEY_LINE;
+var init_redact = __esm({
+  "src/utils/redact.ts"() {
+    "use strict";
+    REDACTED = "[REDACTED]";
+    REDACTED_RE = String.raw`\[REDACTED\]`;
+    KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+    VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
+    REDACT_RULES = [
+      {
+        // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
+        id: "authorization",
+        re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+        replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
+      },
+      {
+        // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
+        // the word must be a whole key segment, so `monkeys=` stays untouched
+        id: "key-value",
+        re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
+        replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+      },
+      {
+        // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
+        id: "env-style",
+        re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:export\s+)?[A-Z][A-Z0-9]*_(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=\s*)(${VAL})`, "g"),
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // long CLI flags only: `--password X`, `--token X`, `--api-key X`, `--secret X`, `--passwd X`
+        id: "cli-flag",
+        re: new RegExp(String.raw`(--(?:password|token|api-key|secret|passwd)(?:\s*=\s*|\s+))(${VAL})`, "gi"),
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // `scheme://user:pass@host` — redact the password, keep user and host
+        id: "url-credentials",
+        re: /((?<![a-z0-9+.-])[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)([^\s/@]+)(@)/gi,
+        replace: (_m, head, _pass, at) => `${head}${REDACTED}${at}`
+      },
+      {
+        // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
+        // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
+        id: "token-prefix",
+        re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+        replace: REDACTED
+      },
+      {
+        // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
+        id: "long-run",
+        re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+        // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
+        replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
+      }
+    ];
+    LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
+    LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+    KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
+  }
+});
+
+// src/hooks/ts/lib/build-gate.ts
+var init_build_gate = __esm({
+  "src/hooks/ts/lib/build-gate.ts"() {
+    "use strict";
+  }
+});
+
+// src/hooks/ts/lib/loop-guard.ts
+var LOOP_MAX_REPEATS, LOOP_READ_STREAK, SELF, LOOP_DENY_REASON, WAIT_CAP_MS, FP_FULL_READ_BYTES, FP_TOTAL_BYTES;
+var init_loop_guard = __esm({
+  "src/hooks/ts/lib/loop-guard.ts"() {
+    "use strict";
+    init_hang_probe();
+    init_redact();
+    init_build_gate();
+    LOOP_MAX_REPEATS = 4;
+    LOOP_READ_STREAK = Number(process.env.PAI_LOOP_READ_STREAK) > 0 ? Number(process.env.PAI_LOOP_READ_STREAK) : 15;
+    SELF = "If your part is done, commit and write your R report. If you are stuck, report the blocker in R x= (or use pai worker help if available).";
+    LOOP_DENY_REASON = `loop guard: you ran this command ${LOOP_MAX_REPEATS} times with the same result and nothing changed. Stop repeating it. ${SELF}`;
+    WAIT_CAP_MS = 45 * 6e4;
+    FP_FULL_READ_BYTES = 256 * 1024;
+    FP_TOTAL_BYTES = 4 * 1024 * 1024;
+  }
+});
+
+// src/audit/scan.ts
+var init_scan = __esm({
+  "src/audit/scan.ts"() {
+    "use strict";
+    init_loop_guard();
+  }
+});
+
+// src/hooks/ts/lib/rules/builtin.generated.ts
+var init_builtin_generated = __esm({
+  "src/hooks/ts/lib/rules/builtin.generated.ts"() {
+    "use strict";
+  }
+});
+
+// src/hooks/ts/lib/rules/load.ts
+var import_yaml6;
+var init_load = __esm({
+  "src/hooks/ts/lib/rules/load.ts"() {
+    "use strict";
+    import_yaml6 = __toESM(require_dist(), 1);
+    init_pai_home();
+    init_builtin_generated();
+  }
+});
+
+// src/workers/scan.ts
+var init_scan2 = __esm({
+  "src/workers/scan.ts"() {
+    "use strict";
+    init_scan();
+    init_load();
+    init_paths();
+    init_status();
+  }
+});
+
 // src/workers/render.ts
 var init_render = __esm({
   "src/workers/render.ts"() {
@@ -8114,6 +8266,7 @@ var init_render = __esm({
     init_scope();
     init_endreason();
     init_report();
+    init_scan2();
   }
 });
 
@@ -8170,6 +8323,8 @@ var init_pane_bar = __esm({
     "use strict";
     init_chatui();
     init_render();
+    init_capacity();
+    init_pane_exec();
     init_pane_policy();
   }
 });
@@ -8179,29 +8334,12 @@ var init_pane_exec = __esm({
   "src/workers/pane-exec.ts"() {
     "use strict";
     init_pai_home();
+    init_capacity();
     init_pane_bar();
     init_pane_policy();
   }
 });
 
-// src/workers/ps-table.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-function truncateLines(text, max = PS_MAX_LINE) {
-  return text.split("\n").map((l) => l.length > max ? l.slice(0, max) : l).join("\n");
-}
-function psTable(format, run = realRunner, maxLine = PS_MAX_LINE) {
-  return truncateLines(run(["-axo", format]), maxLine);
-}
-var PS_MAX_BUFFER, PS_MAX_LINE, realRunner;
-var init_ps_table = __esm({
-  "src/workers/ps-table.ts"() {
-    "use strict";
-    PS_MAX_BUFFER = 64 * 1024 * 1024;
-    PS_MAX_LINE = 1024;
-    realRunner = (args) => execFileSync2("ps", args, { encoding: "utf8", env: { ...process.env, LC_ALL: "C" }, maxBuffer: PS_MAX_BUFFER, timeout: 15e3 });
-  }
-});
-
 // src/workers/pane-title.ts
 var init_pane_title = __esm({
   "src/workers/pane-title.ts"() {

package/dist/hooks/worker-edit-repair.mjs

@@ -7409,7 +7409,7 @@ function parseEscalate(v, bad2) {
 }
 
 // src/workers/config.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
 
 // src/daemon/config.ts
 import { homedir as homedir2, userInfo } from "node:os";
@@ -8974,7 +8974,7 @@ import {
   readdirSync as readdirSync2,
   renameSync as renameSync4,
   rmSync,
-  statSync as statSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
 

package/dist/hooks/worker-guard.mjs

@@ -7409,7 +7409,7 @@ function parseEscalate(v, bad2) {
 }
 
 // src/workers/config.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
 
 // src/daemon/config.ts
 import { homedir as homedir2, userInfo } from "node:os";
@@ -8981,7 +8981,7 @@ import {
   readdirSync as readdirSync2,
   renameSync as renameSync4,
   rmSync,
-  statSync as statSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { join as join8 } from "node:path";
@@ -9254,7 +9254,7 @@ function ownsPid(status) {
       env: { ...process.env, LC_ALL: "C" }
     }).trim();
     const psStart = Date.parse(out);
-    const started = spawnTimeOf(status) ?? Date.parse(status.started.replace(" ", "T"));
+    const started = status.procStart ?? spawnTimeOf(status) ?? Date.parse(status.started.replace(" ", "T"));
     if (Number.isNaN(psStart) || Number.isNaN(started)) return alive(status.pid);
     return Math.abs(psStart - started) <= 12e4;
   } catch {
@@ -10380,7 +10380,7 @@ function decideOrchestratorBash(rawCommand) {
 // src/hooks/ts/lib/loop-guard.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { readFileSync as readFileSync13, statSync as statSync3 } from "node:fs";
+import { readFileSync as readFileSync13, statSync as statSync4 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join11, resolve as resolve5 } from "node:path";
 
 // src/workers/ps-table.ts
@@ -10408,6 +10408,62 @@ function wrapTestCommand(command) {
   return `${WRAP} --cmd-b64 ${Buffer.from(command, "utf8").toString("base64")}`;
 }
 
+// src/utils/redact.ts
+var REDACTED = "[REDACTED]";
+var REDACTED_RE = String.raw`\[REDACTED\]`;
+var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
+var REDACT_RULES = [
+  {
+    // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
+    id: "authorization",
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+    replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
+  },
+  {
+    // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
+    // the word must be a whole key segment, so `monkeys=` stays untouched
+    id: "key-value",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
+    replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+  },
+  {
+    // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
+    id: "env-style",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:export\s+)?[A-Z][A-Z0-9]*_(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // long CLI flags only: `--password X`, `--token X`, `--api-key X`, `--secret X`, `--passwd X`
+    id: "cli-flag",
+    re: new RegExp(String.raw`(--(?:password|token|api-key|secret|passwd)(?:\s*=\s*|\s+))(${VAL})`, "gi"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `scheme://user:pass@host` — redact the password, keep user and host
+    id: "url-credentials",
+    re: /((?<![a-z0-9+.-])[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)([^\s/@]+)(@)/gi,
+    replace: (_m, head, _pass, at) => `${head}${REDACTED}${at}`
+  },
+  {
+    // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
+    // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
+    id: "token-prefix",
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    replace: REDACTED
+  },
+  {
+    // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
+    id: "long-run",
+    re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+    // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
+    replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
+  }
+];
+var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
+var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
+
 // src/hooks/ts/lib/build-gate.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { existsSync as existsSync12, readFileSync as readFileSync12, realpathSync as realpathSync2 } from "node:fs";
@@ -10613,7 +10669,7 @@ function worktreeFingerprint(cwd) {
       if (!p || p.startsWith(".") || p.includes("/.")) continue;
       try {
         const file = join11(root, p);
-        const st = statSync3(file);
+        const st = statSync4(file);
         if (!st.isFile() || !st.size) continue;
         if (st.size > FP_FULL_READ_BYTES || st.size > budget) {
           h.update(`${p}\0${st.size}\0${st.mtimeMs}`);
@@ -10916,7 +10972,7 @@ function saveLoopState(file, state) {
 }
 
 // src/workers/tool-errors.ts
-import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync15, statSync as statSync4, openSync, readSync, closeSync } from "node:fs";
+import { appendFileSync, existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync15, statSync as statSync5, openSync, readSync, closeSync } from "node:fs";
 import { join as join13 } from "node:path";
 
 // src/workers/agentish.ts
@@ -11131,7 +11187,7 @@ function appendStopEvent(logDir, id, stop) {
 }
 
 // src/builds/queue.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync16, renameSync as renameSync6, rmSync as rmSync4, rmdirSync, statSync as statSync5, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync16, renameSync as renameSync6, rmSync as rmSync4, rmdirSync, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join14 } from "node:path";
 var defaultDeps = () => ({
   isAlive: (pid) => {
@@ -11162,13 +11218,13 @@ function breakStaleMutex(m, staleMs = 5e3) {
     mkdirSync8(guard);
   } catch {
     try {
-      if (Date.now() - statSync5(guard).mtimeMs > staleMs) rmdirSync(guard);
+      if (Date.now() - statSync6(guard).mtimeMs > staleMs) rmdirSync(guard);
     } catch {
     }
     return;
   }
   try {
-    if (Date.now() - statSync5(m).mtimeMs > staleMs) rmdirSync(m);
+    if (Date.now() - statSync6(m).mtimeMs > staleMs) rmdirSync(m);
   } catch {
   } finally {
     try {

package/dist/hooks/worker-note.mjs

@@ -7409,7 +7409,7 @@ function parseEscalate(v, bad2) {
 }
 
 // src/workers/config.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
 
 // src/daemon/config.ts
 import { homedir as homedir2, userInfo } from "node:os";
@@ -8959,7 +8959,7 @@ import {
   readdirSync as readdirSync2,
   renameSync as renameSync4,
   rmSync,
-  statSync as statSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
 
@@ -9243,6 +9243,73 @@ function currentWorkerId(env = process.env, logDir) {
 // src/workers/ps-table.ts
 var PS_MAX_BUFFER = 64 * 1024 * 1024;
 
+// src/utils/redact.ts
+var REDACTED = "[REDACTED]";
+var REDACTED_RE = String.raw`\[REDACTED\]`;
+var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+var VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
+var REDACT_RULES = [
+  {
+    // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
+    id: "authorization",
+    re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+    replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
+  },
+  {
+    // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
+    // the word must be a whole key segment, so `monkeys=` stays untouched
+    id: "key-value",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
+    replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+  },
+  {
+    // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
+    id: "env-style",
+    re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:export\s+)?[A-Z][A-Z0-9]*_(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=\s*)(${VAL})`, "g"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // long CLI flags only: `--password X`, `--token X`, `--api-key X`, `--secret X`, `--passwd X`
+    id: "cli-flag",
+    re: new RegExp(String.raw`(--(?:password|token|api-key|secret|passwd)(?:\s*=\s*|\s+))(${VAL})`, "gi"),
+    replace: (_m, head) => `${head}${REDACTED}`
+  },
+  {
+    // `scheme://user:pass@host` — redact the password, keep user and host
+    id: "url-credentials",
+    re: /((?<![a-z0-9+.-])[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)([^\s/@]+)(@)/gi,
+    replace: (_m, head, _pass, at) => `${head}${REDACTED}${at}`
+  },
+  {
+    // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
+    // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
+    id: "token-prefix",
+    re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+    replace: REDACTED
+  },
+  {
+    // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
+    id: "long-run",
+    re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+    // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
+    replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
+  }
+];
+var PEM_BLOCK = /-----BEGIN[^-\n]*PRIVATE KEY-----[\s\S]*?(?:-----END[^-\n]*PRIVATE KEY-----|$)/g;
+var LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
+var LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+var KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
+function redactLine(line) {
+  let out = line;
+  for (const r of LINE_RULES) out = out.replace(r.re, r.replace);
+  if (KEY_LINE.test(out)) out = out.replace(LONG_RUN.re, LONG_RUN.replace);
+  return out;
+}
+function redactSecrets(text) {
+  const withPem = text.replace(PEM_BLOCK, `-----BEGIN PRIVATE KEY----- ${REDACTED}`);
+  return withPem.split("\n").map(redactLine).join("\n");
+}
+
 // src/hooks/ts/lib/loop-guard.ts
 var LOOP_MAX_REPEATS = 4;
 var LOOP_READ_STREAK = Number(process.env.PAI_LOOP_READ_STREAK) > 0 ? Number(process.env.PAI_LOOP_READ_STREAK) : 15;
@@ -9360,10 +9427,8 @@ ${typeof r.stderr === "string" ? r.stderr : ""}`;
   text = text.replace(TMP_PATH, "TMP").replace(/\s+/g, " ").trim();
   return text.length > RESULT_CHARS ? `${text.slice(0, RESULT_CHARS / 2)} ${text.slice(-RESULT_CHARS / 2)}` : text;
 }
-var SECRET_LINE = /pass(?:word|wd)|secret|token|api[_-]?key|credential|authorization|bearer|private key|^\s*(?:export\s+)?[A-Z][A-Z0-9_]*(?:KEY|SECRET|TOKEN|PASS\w*|CRED\w*|AUTH\w*)\s*=|\b(?:sk|ghp|gho|xox[bap])[-_][A-Za-z0-9_-]{16,}|\b[A-Za-z0-9+]{40,}={0,2}(?![\w/])|\b[a-z][a-z0-9+.-]*:\/\/[^\s\/:@]+:[^\s\/@]+@|\b(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}\b|\bgh[pousr]_[A-Za-z0-9]{20,}/i;
-var MASKED_LINE = "[line masked: looks like a secret]";
 function maskSecrets(text) {
-  return text.split("\n").map((l) => SECRET_LINE.test(l) ? MASKED_LINE : l).join("\n");
+  return redactSecrets(text);
 }
 function rawText(response) {
   if (typeof response === "string") return response;